Important: kernel-rt security update
Summary
ALSA-2024:5102: Important: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.16.1.rt7.357.el8_10. Fixed in 4.18.0-553.16.1.rt7.357.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the kernel-rt package. These vulnerabilities include:
- CVE-2023-52463: The efivarfs vulnerability allows an attacker to force read-only access when remounting if SetVariable is not supported.
- CVE-2021-46939: The tracing vulnerability allows an attacker to restructure trace_clock_global() to never block.
- CVE-2023-52622: The ext4 vulnerability prevents online resizing failures due to oversized flex bg.
- CVE-2024-26669: The net/sched: flower vulnerability fixes chain template offload.
- CVE-2024-26802: The stmmac vulnerability clears a variable when destroying workqueue.
- CVE-2024-26843: The efi: runtime vulnerability fixes a potential overflow of soft-reserved region size.
- CVE-2024-26878: The quota vulnerability fixes a potential NULL pointer dereference.
- CVE-2024-36886: The TIPC vulnerability fixes a message reassembly use-after-free remote code execution vulnerability.
- CVE-2023-52653: The SUNRPC vulnerability fixes a memleak in gss_import_v2_context.
- CVE-2024-21823: The dmaengine/idxd vulnerability allows potential security problems with direct access by an untrusted application.
- CVE-2024-35807: The ext4 vulnerability fixes corruption during online resize.
- CVE-2024-35801: The x86/fpu vulnerability keeps xfd_state in sync with MSR_IA32_XFD.
- CVE-2024-35947: The dyndbg vulnerability fixes an old BUG_ON in >control parser.
- CVE-2024-35893: The net/sched: act_skbmod vulnerability prevents kernel-infoleak.
- CVE-2024-35876: The x86/mce vulnerability ensures grabbing mce_sysfs_mutex in set_bank().
- CVE-2023-52864: The platform/x86: wmi vulnerability fixes the opening of the char device.
- CVE-2023-52845: The tipc vulnerability changes nla_policy for bearer-related names to NLA_NUL_STRING.
- CVE-2023-52658: The net/mlx5 vulnerability reverts the block entering switchdev mode with ns inconsistency.
- CVE-2024-25739: The crash vulnerability fixes a missing check for leb_size.
- CVE-2024-26614: The tcp vulnerability ensures initializing the accept_queue's spinlocks once.
- CVE-2024-26640: The tcp vulnerability adds sanity checks to rx zerocopy.
- CVE-2024-26870: The NFSv4.2 vulnerability fixes a kernel BUG at mm/usercopy.c:102.
- CVE-2024-26958: The nfs vulnerability fixes a UAF in direct writes.
- CVE-2024-27388: The SUNRPC vulnerability fixes some memleaks in gssx_dec_option_array.
- CVE-2024-27434: The wifi: iwlwifi: mvm vulnerability prevents setting the MFP flag for the GTK.
- CVE-2023-52679: The of vulnerability fixes a double free in of_parse_phandle_with_args_map.
- CVE-2024-35930: The scsi: lpfc vulnerability fixes a possible memory leak in lpfc_rcv_padisc().
- CVE-2024-35912: The wifi: iwlwifi: mvm: rfi vulnerability fixes potential response leaks.
- CVE-2024-35925: The block vulnerability prevents division by zero in blk_rq_stat_sum().
- CVE-2024-35938: The wifi: ath11k vulnerability decreases MHI channel buffer length to 8KB.
- CVE-2024-35937: The wifi: cfg80211 vulnerability checks A-MSDU format more carefully.
- CVE-2024-35946: The wifi: rtw89 vulnerability fixes null pointer access when aborting scan.
- CVE-2024-36005: The netfilter: nf_tables vulnerability honors table dormant flag from netdev release event path.
- CVE-2024-36000: The mm/hugetlb vulnerability fixes missing hugetlb_lock for resv uncharge.
- CVE-2024-36006: The mlxsw: spectrum_acl_tcam vulnerability fixes incorrect list API usage.
- CVE-2021-47257: The net: ieee802154 vulnerability fixes null deref in parse dev addr.
- CVE-2023-52730: The mmc: sdio vulnerability fixes possible resource leaks in some error paths.
- CVE-2023-52777: The wifi: ath11k vulnerability fixes gtk offload status event locking.
How To Fix
Minimum fixed version
4.18.0-553.16.1.rt7.357.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
In conclusion, this security update addresses multiple vulnerabilities in the kernel-rt package. It is recommended to update the package to the latest version to mitigate these vulnerabilities.
See every vulnerability recorded for kernel-rt →
FAQ
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, or gain elevated privileges.
There are no known exploits for these vulnerabilities at the time of this advisory.
Yes, a system restart is required after applying the update to fully mitigate the vulnerabilities.
No, updating the package should be sufficient to address the vulnerabilities.
You can use Vulert (https://vulert.com) to check if your system is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
